request for proposal ddi (dns-dhcp-ipam) solution · quality computing, voice and data...

Indiana University RFP-TEC-226-2020 – DDI (DNS-DHCP-IPAM) Solution

1

Request for Proposal For

DDI (DNS-DHCP-IPAM) Solution Indiana University

University Information Technology Services

Final Response due no later than 5:00 PM (Eastern Time) on Thursday, March 26th

Issued by: Jennifer K. Guynn Purchasing Contract Manager Indiana University 1000 Waterway Blvd. Suite 101 Indianapolis, Indiana 46202 Issued: 02/24/2020


2

Section A: Table of Contents

SECTION A: TABLE OF CONTENTS .....................................................................................................2

SECTION B: PURPOSE ......................................................................................................................3

SECTION C: BACKGROUND ...............................................................................................................4

SECTION D: PROPOSAL INSTRUCTIONS AND CONDITIONS .................................................................6

SECTION E: SCHEDULE OF EVENTS ....................................................................................................8

SECTION F: STATEMENT OF NEEDS ...................................................................................................9

SECTION G: TERMS AND CONDITIONS ............................................................................................ 11

SECTION H. PROPOSAL RESPONSE ................................................................................................. ..17

APPENDIX A: NON-COLLUSIVE CERTIFICATE .................................................................................... .26

APPENDIX B: SUPPLIER DIVERSITY INFORMATION ............................................................................ ..27

APPENDIX C: INDIANA UNIVERSITY MINIMUM INSURANCE REQUIREMENTS FOR VENDORS ............ ...29 APPENDIX D: FEDERAL DEBARMENT CERTIFICATION ....................................................................... ....33


3

Section B: Purpose

Indiana University (IU) is requesting proposals from firms interested in providing an enterprise level DDI (DNS-DHCP-IPAM) solution that will serve the entire University, including main campuses in Bloomington and Indianapolis Indiana, as well as eight regional campuses across the state of Indiana. The intent of this Request for Proposal (RFP) and the ensuing process is to provide companies with the information, requirements, and specifications necessary for the preparation of a professional and comprehensive proposal. Specific terms and conditions are outlined.

Selection of the successful company (Contractor) will be based upon: • Ability to meet technical specifications and statement of needs• References• Total cost of ownership• Value Add• Acceptance of terms and conditions

These criteria have been listed in order of importance.

As used within this RFP, “Participant” shall refer to those companies receiving and responding to this RFP. “Contractor” shall refer to the successful Participant of the process. “University” shall refer to Indiana University.

If the Participant will not be selling directly to the University, it is the Participant’s responsibility to choose one reseller with whom they will partner on this project.


4

Section C: Background Founded in 1820, Indiana University is a public, multi-campus, 3.2 billion dollar educational institution with over 110,000 undergraduate and graduate students. All 50 states, Washington, D.C., three U.S. territories and over 150 foreign countries are represented. In addition to the student population, IU has over 19,000 faculty and staff supporting the educational mission of the institution. IU spans the state with eight campuses. For more general information about the institution, please visit the institution’s home page at http://www.iu.edu/ and its fact book at http://factbook.indiana.edu/. The University Information Technology Services department (UITS) is charged with the mission of creating, implementing and maintaining a network infrastructure to support scholarship throughout the University system. UITS manages this environment to facilitate the highest quality computing, voice and data infrastructure for research, teaching, learning and those administrative functions supporting the academic mission. Further efforts enhance the University's other missions of providing access to higher education for all citizens of the State of Indiana and to augmenting the economic development of Indiana. UITS manages the network in both the Bloomington (IUB) and Indianapolis (IUPUI) Data Centers, in addition to the interconnected core and building networks. With such broad responsibilities, UITS evaluates and deploys scalable, well-supported solutions and that have a proven record of good performance within peer institutions. To ensure the uptime of the network, the Global Research NOC, or GRNOC, manages a 24/7/365 network operations center that monitors the state of the campus networks. If there are any alerts or performance issues, a campus network engineer is immediately engaged.

Through the Network Master Plan (NMP), IU funds refresh cycles for all critical equipment. The NMP funds all large purchases for network services, including DNS and DHCP for this RFP. This RFP is requesting bids for a complete deployment of a DDI (DNS-DHCP-IPAM) solution, which will be hosted in both IU Data Centers (Indianapolis and Bloomington) in a primary/backup or active/active design.

http://www.iu.edu/

http://factbook.indiana.edu/


5

Information regarding IP space, DNS and DHCP is provided below for sizing purposes:

IP Address space owned by Indiana University:

IPv4: 149.159.0.0/16; 149.160.0.0/16; 149.161.0.0/16; 149.162.0.0/16; 149.163.0.0/16; 149.165.0.0/16; 129.79.0.0/16; 156.56.0.0/16; 140.182.0.0/16; 134.68.0.0/16; 149.166.0.0/16; IPv6: 2001:18e8::/32 IPv4 peak usage: 175,000 IPv6 peak usage: 86,000 DNS records: (Please note this list is approximate)

Record Type Number Static A 98365 Static PTR 95849 CNAMES 8443 MX 425 TXT 9083 AAAA 7115 LOC 8045 SRV 134

DHCP: DCHPv4: 16 virtual servers using ISC DCHPv4 configured as eight pairs of failover clusters that serve all campuses DCHPv6: 8 virtual servers configured using ISC DHCPv6 configured as four pairs of failover clusters that serve the IUB and IUPUI campuses


6

Section D: Proposal Instructions and Conditions D1 All questions and inquiries regarding this document should be submitted via the Jaggaer

supplier portal. If you experience issues, you may contact Purchasing Contract Manager, Jennifer Guynn, directly at [email protected]. EXCEPT FOR CASES AUTHORIZED IN WRITING BY JENNIFER GUYNN, DURING THE DURATION OF THIS RFP PROCESS, THROUGH SELECTION AND NOTIFICATION, ANY COMMUNICATION BY PARTICIPANTS WITH INDIANA UNIVERSITY STAFF OTHER THAN JENNIFER GUYNN MAY RESULT IN IMMEDIATE REJECTION OF THAT PARTICIPANT. Questions regarding this RFP should be submitted through the Q&A Board within the Jaggaer supplier portal as they occur. Questions asked after the deadline shown in the schedule in Section E will not be answered

D2 Proposals (responses) should be submitted via the Jaggaer supplier portal. The

responses must be received by the due date/time stated in Section E. Fax or Telephone Proposals will not be accepted.

D3 The University reserves the right to reject any or all proposals and, in particular any

proposals not containing complete data requested. The University reserves the right to waive any irregularity in any proposal received. Proposal should be submitted initially on the participant’s most favorable terms.

D4 The University will not pay for any information requested herein, nor is it liable for any

costs incurred by the participant in responding to this request. All proposals submitted become the property of the University; they will not be returned and may be subject to the Freedom of Information Act.

D5 Participants may withdraw their proposals prior to the closing time. Proposals received

after the time set for receipt will not be considered. The proposal constitutes an offer by the participant, which shall remain open and irrevocable for a period of 90 days.

D6 After the RFP closing time, proposals will be opened and reviewed at the convenience of

the Purchasing. There is no public opening. D7 The University reserves the right to accept the proposal that appears to be in the best

interests of Indiana University and to negotiate a contract with that participant using the proposal submitted as a basis.

D8 Any information released either verbally or in writing prior to the issuance of this

request shall be deemed preliminary and not binding upon the University in any manner.


7

D9 If requested, participants must submit audited financial statements for the past two (2) years (or equivalent data) in order to demonstrate financial capability to provide the required services.

D10 Participants may be invited to come to Indiana University to provide a presentation

about their submission at their own expense. D11 The University will not enter into any agreement or execute any contract or affix

signature to any document from a participant whose terms, written or verbal, require the University to waive all conditions or requirements negotiated, provided for in this document, our purchase order, or by mutual consent. Any document containing a clause or clauses that serve to supersede all other documents attached to this transaction may be rejected.

D12 Notwithstanding any other provision of this Request for Proposal, the University

expressly reserves the right to:

1. Conduct discussions with any or all participants for the purpose of clarification of proposals;

2. Waive, or decline to waive, any insignificant defect or informality in any proposal or proposal procedures;

3. Accept, reject, or negotiate the terms of any proposal, or any parts thereof, for the purpose of obtaining the best and final offer;

4. Reissue a Request for Proposal; 5. Select the finalist(s) based on the University's analysis and evaluation of

proposals submitted. The University reserves the right to request presentations of proposals if the University feels further information is appropriate to the decision-making process.

6. Negotiate with any or all of the participant’s representatives for the purpose of obtaining best and final offers. However, proposals will be evaluated on the assumption that the proposed costs/revenues are your most favorable.

D13 The University reserves the right to use any and all concepts presented in any reply to

obtain the most beneficial and effective path to achieving the desired goals. Selection or rejection of submittals shall not affect this right.

D14 By virtue of submittal, the participant is attesting that all requirements, terms, and

conditions in Section G have been read and understood. Unless the responding participant expressly and specifically provides otherwise in its written proposal, the proposal received in response to this Request for Proposal shall automatically be deemed to include the responding participant’s agreement to all terms and conditions of the RFP.


8

D15 Your response to this Solicitation constitutes an offer to do business with Indiana University under (at a minimum) the terms, conditions and pricing collectively gathered by this Solicitation process. In the event a contract is awarded, the University, at its option, may incorporate all or parts of your response in that contract. Any or all answers and information contained within your proposal shall become part of the final agreement between you and the University.

D16 All proposals or offers must be signed by a duly appointed officer or agent of your company.

D17 Unless judged a trade-secret, no part of your offer or proposal can be guaranteed proprietary or confidential. As required by the Indiana Open Records law, I.C. 5-14-et seq., submittals may become public information once a contract has been completed.

D18 Proposals responding to this Solicitation shall not be tied to any potential or future arrangements.

Section E: Schedule of Events

Following is the detailed schedule of events for this RFP. The University reserves the right to modify the below schedule.

ACTIVITY DATE E1 Request for Proposal issued. 2/24/2020 E2 Participants’ questions concerning the proposal

must be received no later than 5:00 pm Eastern Time, in accordance with Section D1. An email response or status of response will be provided within 24 hours. If the information is related to substantive content of the RFP, then clarifications will be sent to all known participants of the RFP.

3/12/2019

E3 Proposals due by 5:00 pm Eastern Time, in accordance with Section D2. 3/26/2020

E4 Meetings with vendors to discuss proposals and related Q&A (if required). 4/6/2020-4/21/2020

E5 Proof of concept testing (if required) completed no later than 5/15/2020

E7 Selection of vendor no later than 5/22/2020 E8 Delivery of equipment to begin, on or before 6/15/2020


9

Section F: Statement of Needs

Objectives

Indiana University (IU) is seeking to purchase an enterprise solution for a DDI (DNS-DHCP-IPAM) solution.

F1 Replace Existing DNS-DHCP-IPAM Solution

The current DNS-DHCP-IPAM solution consists of ISC DNS and DHCP, along with an internally developed IPAM application. The scope of this RFP is to replace the current environment with a vended solution.

F2 Scope of Work

F2.1 Proposal. The selected Contractor must propose needed hardware and software, along with related pricing, which meets the objectives and criteria defined in sections F1 through F2, and technical requirements in section H.

Support and licensing pricing for 5 years for all components, including software and hardware should be included.

Upon award of the RFP, IU will proceed to order equipment to replace the current the current DNS-DHCP-IPAM solution.

F2.2 Training. The selected Contractor must provide training to six University personnel on the proposed products in a facility within 30 miles of the IUPUI or IUB campus. The training can be on-site at IU. This training shall include instruction on the hardware, software, operating systems, configuration, and troubleshooting of the equipment which is pertinent to the University’s intended use of the equipment. Training should also include conversion of the current environment to the proposed solution. Due to the scope of the project, training is a critical component to ensure the engineering staff is able to effectively expand and support the proposed solution.

Describe in detail the training curriculum that will be offered to the University, the location of the training, and associated costs if any. It would be preferred for training to occur before or around the delivery of solution components.

F.2.2.1 Optional Certification

Certifications pertaining to the equipment being purchased and their supporting systems should be listed as an optional cost.


10

F2.3 Technical support. The selected Contractor must provide technical support from the equipment manufacturer on the proposed hardware and software for a period of 5 years. Any hardware or software not covered under a lifetime warranty should include 5 years (60 months) of support, including software updates and next-business day parts replacement.

Any support must include online access to software upgrades, online access to the manufacturer’s knowledge base, online initiation of technical support cases, phone-based initiation of technical support cases, and initial response from a technical support engineer within two hours of initiating a technical support case, and next-business-day replacement of failed hardware.

F2.4 Equipment Delivery

Equipment should arrive on or before June 15, 2020.

F2.5 Mitigation of Risk

With a vast and complex environment, the Participant should describe how risk and downtime would be avoided in the conversion from the current environment to the proposed solution.

F2.6 Value Add

Please describe any additional services that you would like to include at no cost to the University such as but not limited to the items listed below:

• Tier 3 engineer availability on site for initial implementation • Direct access to Tier 3 engineers for on-going support • Training offerings on proposed solution


11

Section G: Terms and Conditions The following terms and conditions will become a part of an agreement that will be entered into by the Contractor and Indiana University. G1 Contract Term

The contract will commence once a Contractor is chosen and an agreement is in place.

G2 Applicable Law The Agreement shall be governed by the laws of the State of Indiana, and Contractor shall at all times comply with and observe all federal, state and local laws, ordinances, and regulations which are in effect during the period of the Agreement and which in any manner affect the work or its conduct.

G3 Agreement Assignment No right or duty in whole or in part of the Contractor under the Agreement may be assigned or delegated, including by transfer of stock or ownership in Contractor, without the prior written consent of the University.

G4 Conflict of Interests

Private and non-profit corporations are bound by state statute regarding conflicts of interest by employees in the conduct of state agreements. A completed non-collusion certificate must accompany the signing of the Agreement.

G5 Agreement Termination

Termination for Cause Should either party breach any material terms or provisions of the Agreement, the non-breaching party shall promptly serve the breaching party with written notice setting forth the alleged breach. Unless the breaching party, within ten (10) working days of the receipt of the notice, has corrected or has taken reasonable steps toward correcting the alleged breach, the non-breaching party may terminate the Agreement by giving thirty (30) days written notice to the breaching party of its intention to terminate the Agreement. Certified letter must give written notice of termination. The University may cancel the Agreement for breach, as determined by the University, of any material terms or provisions, including but not limited to insufficient insurance coverage or service unsatisfactory to the University. This may also include any cessation or diminution of service including but not limited to failure to maintain adequate personnel whether arising from labor disputes, or otherwise, any substantial change in ownership or proprietorship of the Contractor which, in the opinion of the University, is not in its best interest. Certified letter must give written notice of termination.


12

G6 Notices

With the exception of notice of termination, which must be made by certified mail, any written notice called for in the Agreement may be given by personal delivery, first class mail, overnight delivery service or facsimile transmission. Notices given by personal delivery will be effective on delivery; by overnight service, on the next business day; by first class mail, five business days after mailing; and by facsimile, when an answer back is received.

G7 Non-Discrimination

In connection with the performance of work under the Agreement, the Contractor agrees not to discriminate against any student, employee or applicant for employment because of age, race, religion, color, handicap, sex, sexual orientation, or national origin. This provision shall include, but not be limited to, the following: employment, upgrading, demotion or transfer, recruitment or recruitment advertising, lay-off or termination, rates of pay or other forms of compensation, and selection for training, including apprenticeship. The Contractor further agrees to take affirmative action to insure equal employment opportunities. If present on the campus, Contractor, including all employees and agents, shall agree to abide by, and comply with, all Indiana University, federal, state, and local policies, regulations, and laws that pertain to sexual harassment and non-discrimination. Contractor further agrees that employees and agents, while on University’s premises, shall comply with and observe all applicable rules and regulations concerning conduct on the University’s premises, which are imposed upon the University’s employees and agents.

G8 Excused Performance

If, because of riots, war, public emergency or calamity, fire, flood, earthquake, act of God, government restriction, business operations at the University are interrupted or stopped, the performance of the Agreement, with the exception of money already due and owing, shall be suspended and excused to the extent commensurate with such interfering occurrence. The expiration date of the Agreement may be extended, by mutual written consent, for a period of time equal to the time that such default in performance is excused.

G9 Independent Contractor Relationship

It is mutually understood and agreed that an independent contractor relationship is hereby established and that employees of the Contractor are not employees of the University and that employees of the University are not employees of the Contractor.

G10 Severability

If any provision of the Agreement or its application to any party or circumstances shall be invalid or unenforceable to any extent, the remainder of the Agreement and the


13

application of its provisions to other parties or circumstances shall not be affected and shall be enforced to the extent permitted by law.

G11 No Waiver

The failure of University to insist in any one or more instances upon the performance of any one or more of the provisions of the Agreement or to pursue any rights here under shall not be construed as a waiver of any such provisions or the relinquishment of any such rights.

G12 Endorsement

Unless specifically authorized in writing by the University Purchasing Department on a case by case basis, Contractor shall have no right to use, and shall not use, the name of Indiana University, its officials or employees, or the seal or marks of the University in advertising, publicity, or promotion; nor to express or imply any endorsement of Contractor’s supplies or services.

G13 Non-Performance

In the event that Contractor fails to perform under the terms and provision of the agreement, the Contractor shall reimburse the University for any additional expense incurred by the University to have the work completed by a third party over and above what the University would have been required to pay Contractor had Contractor not failed to complete the work.

G14 Force Majeure

Neither party shall be in considered in breach of the agreement for failure to perform if such failure is caused by national or local calamity, acts of terrorism, the act or regulation of any public authority, labor difficulty or strike, war, epidemic, fire, storm, inclement weather or other act of God, or any other cause beyond the reasonable control of the non-performing party that renders that party’s performance impossible.

G15 Funding

The University represents that, as of the date of the Agreement, funds sufficient to pay immediate financial obligations under the Agreement have been allocated and are available. However, University is a publicly funded entity and our ongoing financial obligations herein are subject to allocation of funds by parties not controlled by the University. In the event, through no action initiated by the University, the legislative body of the State of Indiana does not appropriate sufficient funds allowing for the continuation of the agreement for any fiscal year, whole or part, and there are no funds from other sources to continue, the Agreement may be terminated by University.

G16 Data Security Contractor shall treat all data that it receives from University, or is otherwise exposed to within University data systems, with the highest degree of confidentiality and in


14

compliance with all applicable federal and state laws and regulations and University policies. Contractor shall employ commercial best practices for ensuring the security of all University electronic and paper data accessed, used, maintained, or disposed of in the course of Contractor’s performance under this Agreement. Contractor shall only use such data for the purpose of fulfilling its duties under this Agreement and shall not further disclose such data to any third party without the prior written consent of Indiana University or as otherwise required by law. Upon termination or expiration of the contract, Contractor will either return or confirm the secure destruction of all University documents, records and data, at University’s election. Without limiting the foregoing, in the course of performing its duties under this Agreement Contractor may receive, or be exposed to, the following types of data: student education records; financial information as that term is defined in the Financial Modernization Act of 1999; protected health information as that term is defined in the Health Insurance Portability and Accountability Act; and various items of personal identifying information including but not limited to Social Security Numbers, credit card numbers, financial account numbers and corresponding security or access codes and passwords, drivers license numbers, and Indiana state identification card numbers. Contractor shall employ sufficient administrative, physical, and technical data security measures to meet the requirements under the specific federal and state laws and credit card industry standards applicable to those data, including but not limited to: Student Education Records: The Family Education Rights and Privacy Act (FERPA), 20 USC 1232g et seq., and related regulations at 34 CFR Part 99; Financial Information including credit card and financial account numbers: The Financial Modernization Act of 1999, 15 USC 1681 et seq.; the Safeguards Rule at 16 CFR Part 314; and Indiana Code 4-1-11 and 24-4-9. Protected Health Information: The Health Insurance Portability and Accountability Act (“HIPAA”), 42 USC 1320d-2 (note); implementing privacy and security regulations at 45 CFR Parts 160 and 164, and related agency guidance; and the terms of any Business Associate Agreement or LDS agreement between University and Contractor; Social Security Numbers: Indiana Code 4-1-10, 4-1-11, and 24-4.9. Driver’s License Numbers: Indiana Code 4-1-11 and 24-4.9. Credit Card Numbers: Indiana Code 4-1-11 and 24-4.9; the Payment Card Industry Data Security Standards. Immediately upon becoming aware of a breach of the Contractor’s security that reasonably may have resulted in unauthorized access to University data, Contractor shall notify University and shall cooperate fully with University’s investigation of and


15

response to the incident. Except as otherwise required by law, Contractor shall not provide notice of the incident directly to the persons whose data were involved, without prior written permission from University. Contractor acknowledges and agrees that University is subject to Indiana’s Open Records law, I.C. 5-14-et seq., and that disclosure of some or all of confidential information provided pursuant to this Agreement, or the Agreement itself, may be compelled pursuant to that law. University agrees that, upon receipt of a request for confidential information made pursuant to the Indiana Open Records law, it shall a) promptly notify Contractor of the fact and content of the request, b) consult with Contractor regarding any legitimate basis on which it might resist or narrow its response to the request, and c) disclose only information that University, in the opinion of its legal counsel, is legally compelled to disclose.” Notwithstanding any other provision of this agreement, Contractor shall reimburse the University in full for all costs, expenses, and liabilities of any kind whatever incurred by the University as a result of Contractor’s failure to comply with the above data confidentiality and security requirements. This obligation shall include defending, indemnifying, and holding the University harmless from any third party claims or causes of action of any kind arising from or relating to the Contractor’s use, maintenance, or handling of University data received in connection with its performance under this Agreement. These remedies shall be in addition to any other remedies provided within this Agreement or otherwise available under law.

G17 Indemnification Contractor shall indemnify and save harmless The Trustees of Indiana University, its

officers, agents and employees from any and all losses, costs, damages, liability and expenses (including costs of defense, settlement, and reasonable attorney’s fees) in connection with claims or suits for damage to property and/or injury to persons, including death, alleged or claimed to have been caused, by or through the performance of the work or operations incidental to the work, by the Contractor, its agents or employees, or by its subcontractors of any tier, their agents or employees, whether through negligence or willful act; and Contractor shall at request of the University undertake to investigate and defend any and all such claims or suits against the University.

G18 Insurance Requirements Minimum insurance requirements are listed in Appendix C. G19 University Infrastructure Data

In consideration of the Homeland Security Act, a Participant in this Solicitation may be required to submit a signed Non-Disclosure Agreement attached as Appendix E to this RFP. To facilitate your thorough response to this Solicitation, you may receive access to


16

protected systems or media containing restricted information. Upon executing the aforementioned Agreement enclosed with this Solicitation, you will be permitted to use, access, and/or retain such information. Your contractual guarantee that you will afford appropriate measures to secure the information provided and return any such proprietary information at the completion of this Solicitation, a contract, or termination of a contract is a required step to proceed in this transaction.


17

Section H. Proposal Response The Participant’s response to this proposal should include answers to the following series of questions. So that the RFP team can easily follow the questions and responses, please assure that the question is stated immediately before the response. In addition to point-by-point responses, you may include descriptive literature if you refer to specific contents. In reviewing the proposals, university personnel will not search through general literature. Where a question is asked, answer the question and supply any supportive detail. Any deviation from this format and sequence may result in the proposal being immediately rejected. While responses should address all solicitation items, it is important to note that we also encourage and will consider any creative ideas for functional improvements or cost savings related to this transaction that may not be suggested in this document. Functional, technical, and economic solutions beyond the confines of this solicitation may also be considered. The responses should address all solicitation items. However, the University reserves the right to consider other ideas and solutions, or only a restricted subset of the configuration discussed in this document. All optional arrangements should be described and priced separately.

H1 All proposal responses must include:

H1.1 The name, address, phone and fax number, and email address for the duly

authorized agent submitting the proposal.

H1.2 Full description of company, including experience, qualifications and organizational chart.

H1.3 Documentation of any intent to partner with a reseller for any part or the whole

of the services offered in response to this RFP. H1.4 Completed Non-Collusive Certificate (attached as Appendix A).

H1.5 Discuss current supplier diversity participation by your company (attached as

Appendix B).

H1.6 Copies of all documents that could become a part of a final Agreement arising from this process. A legal review of the Participant’s proposed Agreement terms will be part of the criteria in evaluating the Participant’s offer.


18

H1.7 The Participant must provide five reference customers. A minimum of two references must be from higher educational institutions of 20,000 students or greater within the United States using the proposed equipment in a similar manner to IU. However, three of these references are strongly desired.

H2 Pricing:

H2.1 Provide a proposal that includes the following: • All hardware and software necessary to provide DNS-DHCP-IPAM services

for a large higher-education environment, including associated supportand licensing for 5 years.

• Any additional software for monitoring, measuring, and troubleshootingthe DNS-DHCP-IPAM solution including associated support and licensingfor 5 years.

• All pricing should be provided in line item detail format.

H2.2 In addition to the proposal in H2.1, a pricing list of all hardware and software components offered as part of this RFP is required. This pricing list should be provided in Excel format and include a list price column, a discount column with the discount percentage offered, and a net price column.

H2.3 Provide the cost, if any, for any training offerings.

H2.4 Please indicate if proposed Value Add items in Section F2.6 will be at no cost. Otherwise, please indicate line item pricing for optional services.

H3 Provide point-by-point responses in Section F, describing in detail your company’s capability of meeting the stated objectives and needs, while meeting the technical requirements beginning in Section H7.

H4 Describe in detail similar DDI deployments your company has executed in the past 3-5 years.

H5 Describe in detail similar DDI deployments your company has executed in the past 3-5 years for an institution of higher education within the United States.

H6 Describe your methodology for providing requested services, how you organize your team and the IU team, and how you ensure you deliver a quality product that meets expectations.

H7 All proposed solutions must offer components, which support the following list of features. Please simply affirm or deny that your proposed solution meets the following requirements by notating each item with “accept,” “deny,” or “variance.” Please explain


19

any variances in your product. The Participant cannot answer “accept,” if the feature is not currently available in the proposed hardware running current general availability (production) release software. If a feature is not in production software at the time of the RFP submission, the Participant must choose “deny” or “variance.” If a feature not in production software is described under a “variance,” it must be noted the feature is not currently available.

H7.1 Required items (all components):

H7.1.1 The architecture should ensure complete redundancy at both hardware and application level to provide highly robust and high availability system.

H7.1.2 Simple non-disruptive method to apply software updates to all parts of the infrastructure and query and report associated update levels.

H7.1.3 Vendor commits to a quick release of security related patches, as well as continuing to develop software versions with new features and improvements.

H7.1.4 Support VLSM - Address management, DHCP scopes, DNS classless delegation.

H7.1.5 IPv4 & IPv6 feature parity & dual-stack for management, nativeIPv6 support at both transport and record level.

H7.1.6 Audit records created for every event or user operation and ability to search all audit efficiently. Offer tools to adjust audit alarm levels and send critical real-time alarms to designed party.

H7.1.7 Fully documented APIs to get/set data contained within including reference programs using the APIs.

H7.1.8 Program-to-program authentication/authorization (vs. person-to-person) including with APIs. For example, having a cron job asking for data or changing it.

H7.1.9 Provide an efficient way to provide system logging out to a SIEM product.

H7.1.10 Monitor and report system health through monitor using applications like Nagios and Monit.

H7.1.11 Two-factor authentication supported on all user and administrator interfaces,


20

H7.2 IPAM Required items:

H7.2.1 Secure distributed administration by at least 150 users in various locations using various OS and browser combinations, without any additional software installed on the client.

H7.2.2 Support at least 30 concurrent authenticated users. Please specify if licensing is related to concurrent user count.

H7.2.3 Ability to physically separate the IPAM setup across two core datacenters. Ability to handle a situation that involves one data center being unavailable, while the other data center is able to provide all services in real-time without human intervention and without loss of any data.

H7.2.4 Delegated permissions based on IP block, IP subnet, IP range, hostname, domain or otherwise, with different permissions assigned to each delegation, based on Active Directory group. Integrable with MS Active Directory without agent setup. Manage multiple users with different access level with flexible security models provided to administrative users.

H7.2.5 User customizable input fields on each level of IP/host structure, (the fields must be search-able/group-able) a) Contact (email address) for security related issues b) Security classification of data on/through host (drop down) c) Asset Number/tag.

H7.2.6 Ability to hijack domains and redirect to campus webserver for domains that pose a threat to campus (hosting malware, etc.).

H7.2.7 Deny and/or issue warnings about illegal operations in the administrative UI and the API (i.e. domain name already exists, domain name that is SOA cannot be made into a CNAME record, etc.).

H7.2.8 Support ability to make bulk moves or bulk adds of IP address assignments, from one subnet to another, to copy and paste records between or within subnets, and subdomains. Provide check tools to compare before and after bulk changes.

H7.2.9 Flexible method for describing naming conventions for dynamically assigned names.


21

H7.2.10 DNS and DHCP services to share a common database for integration of the two. For example, a change made in DHCP should be reflected within DNS automatically.

H7.2.11 Provide record lock/unlock tools at admin level to protect critical records.

H7.2.12 Schedule tasks to take effect automatically at future date/time and send notification after scheduled job is done with status (success or fail).

H7.2.13 Provide useful templates to enable automation and standardize the creation of DHCP/DNS configurations across the network.

H7.2.14 Provide detailed reporting on all aspects of the system including management, DNS/DHCP address assignment, system usage and performance, data trends, and security analysis.

H7.2.15 Provide backup and recovery tools, with the ability to recover and display historical data

H7.2.16 Provide effective tools at administrative level to debug common DNS/DHCP problems.

H7.2.17 Provide tools for administrators to view and test load the data before pushing out to end servers.

H7.2.18 Integration with existing cloud solutions like AWS or Cloudflare.

H7.2.19 Tools to load existing main DHCP and DNS config, and report any inconsistency between loaded and existing data. Provide tools for administrators to view and test data before pushing out to end servers.

H7.2.20 Integration with Microsoft ADS domain controller (ADS);

• Transfer and process ADS data; IU ADS domains zones aretreated differently on internal and external nameservers. Forinternal DNS, ADS domain is a delegated zone, for external it isan authoritative zone

• Capable of loading different sets of data on different serverswithout having to duplicate all the data sets. IU has some DNSrecords that need to return a different answer based on thequery source, instead of having to duplicate the whole datasetto reflect the differences.

H7.2.21 Administrator interface and API tool to block device based on MAC/username/DUID.


22

H.7.2.22 Provide NTP services and support.

H7.3 DHCP Required items:

H7.3.1 Ability to define custom DHCP options and DHCP option scopes information.

H7.3.2 Provide information related to DHCP hosts: First seen, last seen, switch port information, username, MAC, IP.

H7.3.3 Ability to group similar hosts across multiple subnets so that they get the same set of DHCP options.

H7.3.4 Ability to set DHCP T1 (renewal timer) and DHCP T2 (rebinding timer) on a per-scope basis.

H7.3.5 Support DHCPv6 with administrative interface to maintain.

H7.3.6 Support DHCP reservations.

H7.3.7 Support DHCP native failover with active-active pair located at two different locations/data centers. Both servers should be able to handle load for prolonged periods of time in the event of the other server is not available.

H7.3.8 DHCP lease report and adjustable alarm feature to view and report usage, which should include history data, exportable to file, like Excel or .csv.

H7.3.9 Support IPv6 DUID accountability.

H7.3.10 Ability to take a list of host identifiers (MAC address or DUID) and assign a quarantine IP and VLAN.

H7.4 DNS Required items:

H7.4.1 Ability to create blackhole domains.

H7.4.2 Support external ISC BIND servers (allow zone transfers to/from external servers).

H7.4.3 Support creation and operation of hidden internal name servers and hidden masters.

H7.4.4 Support BGP Anycast on virtual and physical devices across multiple datacenters.


23

H7.4.5 Support DNS stub zones, including secondary zone transfers from both IU and non-IU networks, zone notifications, scheduled and emergency loading of zones.

H7.4.6 Protect systems, data, and end users from DNS related threats such as hijacking and cache poisoning.

H7.4.7 Ability to detect, notify, and protect against DNS DDoS amplification attacks.

H7.4.8 Support DNS serve-stale feature.

H7.4.9 Support BGP anycast for both V4 and V6 with debug and report tools.

H7.4.10 Support asymmetric routing.

H7.4.11 Support Dynamic DNS with simple methods to administer DDNS namespaces and delegation DDNS zones.

H7.4.12 Support creation of static DNS reverse zones on dynamic DHCP scopes, in order to minimize zone updates from masters to slaves.

H7.5 Preferred items:

H7.5.1 User-configurable alerts (email and/or SNMP trap) based on potential problems. For example, DHCP subnet reaching X% of capacity.

H7.5.2 Command line interface (vs. web interface) to perform non-admin type functions. For example, the ability to create an A record.

H7.5.3 Ability to do network scans across multiple hardware vendors in both switching and routing, including Aruba, Cisco, Dell, Juniper.

H7.5.4 Integration with Aruba ClearPass policy manager.

H7.5.5 Provide automated routines to notify and/or remove DNS/static IP assignments that have not been seen on the network for set amount of time.

H8 Each Participant must answer the following set of questions designed to help identify basic metrics, product scalability, and overall product suitability for enterprise deployments.

H8.1 General Features:

H8.1.1 Describe the overall architecture of the hardware and software being proposed, with specific focus on capacity to handle large-scale enterprise workloads.


24

H8.1.2 Describe the OS upgrade process for the proposed architecture; with specific focus on how upgrades are completed with no interruption of service.

H8.1.3 Describe your best practices and recommendations for large-scale deployments; particularly in the context of a large higher-education institution.

H8.2 Hardware Maintenance and Service:

H8.2.1 Specify the proposed network hardware and software release date(s).

H8.2.2 If it exists, specify the proposed network hardware end-of-sales date(s).

H8.2.3 If it exists, specify the proposed network hardware end-of-support date(s).

H8.2.4 Describe, in detail, your hardware support and replacement methodology in the event of a large-scale natural disaster or national incident. Specify any FEMA frameworks that are used as a reference architecture for your response process.

H8.3 Physical, Power, and Cooling Characteristics:

H8.3.1 Describe any capabilities for power utilization monitoring and reporting within the proposed solution.

H8.3.2 Specify the height, in number of rack units, for the proposed hardware.

H8.3.3 Specify the maximum power consumption of the proposed hardware when fully populated.

H8.3.4 Specify the maximum BTU output of the proposed hardware when fully populated.

H8.3.5 Specify the capabilities in the proposed hardware for hot insertion and removal of components such as modules/power supplies/fan trays. These tasks should not require a reboot of the hardware or create any disruption in the functionality of the hardware.

H9 Each Participant is encouraged to list features that provide additional value or functionality not described above.

H10 Each Participant should provide electronic copies, or web access, to documentation for the proposed solution components.


25

H11 At the request of Indiana University, selected participants may be asked to perform Proof–of-Concept testing (PoC). While Indiana University can accommodate an onsite PoC, engineers may choose to travel on-site or request a remote-PoC if the participant is able to accommodate. Testing will be geared towards configuration, performance and resiliency.

If a PoC is requested, participants will collaborate with engineers to formulate a PoC plan. Participants may also provide a PoC proposal with their response describing their capabilities to meet the requirements above. Indiana University reserves the right to add or remove test items. A copy of final configuration files from all tested equipment should be provided in addition to relevant test results and metrics at the conclusion of the POC.

H12 Participants may be asked to provide a two-year (24-month) product roadmap during the RFP process.

H13 If a Participant lists a feature or hardware that is not in production at the time of proposal submission, the Participant must describe how they will verify the feature is in production code or that hardware will be available no later than June 15, 2020. This verification must include notation of the added feature in software release notes and possible demonstration of the feature on the proposed equipment using production code. Hardware must be customer orderable on or before June 15, 2020. The Participant is responsible for any costs associated with feature verification.

H14 Signature:

The submission must be signed by a legally authorized agent of the firm.

Name: __________________________________

Signature: __________________________________

Title: __________________________________

Company: __________________________________

Phone: __________________________________

Date: __________________________________


26

APPENDIX A: NON-COLLUSIVE CERTIFICATE

By submission of this document, each person signing certifies, and in the case of a joint submittal, each party thereto certifies as to its own organization, under penalty of perjury, that to the best of its knowledge and belief:

1. The content of this request has been arrived at independently without collusion,consultation, communications, or agreement for the purpose of restricting competition as toany matter relating to service or cost with any other contractor(s) or with any competitor;

2. No attempt has been made or will be made by Contractor to include any other person,partnership or corporation to submit or not to submit a response for the purpose of restrictingcompetition and;

3. No employee, agent or consultant of Indiana University has received or will receive anypayment or any other form of compensation from Contractor as a result of award of anagreement or promise of award to Contractor.

Name: __________________________________

Signature: __________________________________

Title: __________________________________

Company: __________________________________

Date: __________________________________


27

APPENDIX B: SUPPLIER DIVERSITY INFORMATION

Participants in this RFP are required to return Appendix B with the appropriate information provided.

☐This information is not applicable to my business, firm or corporation.

Indiana University encourages participants in this RFP to become involved in our Supplier Diversity Program.

The Supplier Diversity Program tracks businesses that qualify as Minority (MBE), Small Disadvantaged Business (SDB), Women-Owned Business Enterprises (WBE), HubZone, or Veteran Owned Business Enterprises.

To qualify as one of the above business classifications, your company must be at least 51% owned, controlled and actively managed by a person in one of the categories listed above. For more information, please go to this website: http://www.indiana.edu/~busdiv/supplier_certification_form.doc

State your company’s status: ________ Small Business ________ WBE

________ HubZone ________ SDB ________ Historically Black

College/University ________ MBE ________ Veteran Owned ________ Service Disabled

Veteran Owned

- PLEASE ATTACH CERTFICATION WITH COMPLETED FORM -

Does the Participant’s business currently have a Supplier Diversity Program in place? Yes _______ No _______

If the Participant answered “yes”, please provide the name and telephone number of the Participant’s Program Coordinator __________________________________________

http://www.indiana.edu/%7Ebusdiv/supplier_certification_form.doc


28

Identify any and all Second Tier Business Relationships or First Tier Business Relationships Supplier has with Minority, Women, and Disadvantaged Owned and operated businesses. (1st Tier is defined as -- Any supplier, regardless of type or size, which has a direct contract with Indiana University. 2nd Tier is defined as -- Any supplier, regardless of type or size, which is contracted through a 1st tier supplier to Indiana University.)

Name: __________________________________

Signature: __________________________________

Title: __________________________________

Company: __________________________________

Date: __________________________________


29

Appendix C: INDIANA UNIVERSITY MINIMUM INSURANCE REQUIREMENTS FOR VENDORS

Contractor (whether corporation, sole proprietorship or partnership) shall procure and maintain during the term of the contract and until final acceptance of the completed work under the contract, and shall deposit with Owner prior to beginning work, Certificate(s) of Insurance evidencing the types of coverages and minimum limits as set out in this Exhibit.

No contractor or subcontractor shall commence work and shall not be paid for any work performed until proper certificate(s) of insurance have been submitted to and approved by the owner. All required insurance policies shall be written by a company(s) authorized to do business in Indiana. The owner shall not be liable to any person for the failure of the contractor or any subcontractor to carry specified insurance.

CERTIFICATE HOLDER: The Trustees of Indiana University

c/o Office of Insurance, Loss Control & Claims 400 E. 7th Street Room 705

Bloomington, IN 47405-2206

ENDORSEMENTS

All insurance policies must provide the following endorsements to their policy and must be noted on the certificate(s):

1. Additional Insured Endorsement (CG2010 10 01 and CG2037) or equivalent form required onGeneral Liability, Automobile Liability and Excess Liability policies naming the Owner and/orOther Parties as defined in Owner’s Contract and including coverage for completed operations.(Owner is defined as: “The Trustees of Indiana University, its officers, agents and employees”).

2. Waiver of Subrogation on Comprehensive General Liability, Automobile Liability, andEmployer’s Liability/Workers’ Compensation Policies.

3. All insurance policies shall be primary and non-contributing with any insurance carried bythe University, and shall contain a severability of interests clause in respect to liability,protecting each named insured as though a separate policy had been issued to each.

4. All policies shall contain a covenant requiring (30) days written notice by the insurer to theIndiana University Office of Insurance, Loss Control & Claims before cancellation, reduction orother modifications of coverage for any reason.


30

5. Because of the provisions of the ACORD 25 form, each type of liability insurance (general,automobile and excess) must include a copy of a valid endorsement such as CG 20 33 07 04 asassurance that the additional insured requirement has been met.

TYPE OF INSURANCE COVERAGES REQUIRED

TYPE OF INSURANCE COVERAGES REQUIRED: GENERAL LIABILITY/OCCURRENCE FORM

MINIMUM COVERAGE REQUIREMENTS

Commercial General Liability General Aggregate $2,000,000 Premises and Operations Occurrence $1,000,000 The policy must cover claims arising from sexual misconduct.

Personal and Advertising Injury Aggregate $1,000,000

AUTOMOBILE LIABILITY (Contact INLOCC about the need for this coverage.) Combined Single Limit

• Any Auto• Hired Autos• Non-Owned• Medical Payments

$1,000,000 Each Accident

Note: Owner reserves the right to require increased limits of coverage if, in opinion of the Owner, project is hazardous in nature or poses a higher than usual risk.

WORKER’S COMPENSATION, OCCUPATIONAL DISEASE AND EMPLOYER’S LIABILITY

If the Vendor will be on University premises (other than incidental visits to the Purchasing Department), the Vendor shall procure and maintain a Workers' Compensation policy to cover its obligation under the applicable laws of any state or federal government to its employees employed on the jobsite or elsewhere on this project, including its liability as an employer under common law (commonly known as Employer's Liability Coverage "B") with limits of not less than that listed below. Before commencing contracted activities, Vendor shall submit to IU a valid State Form 41321 (Certificate of Compliance - Worker's Compensation and Occupational Diseases) or a facsimile thereof at IU's option. If the Vendor is not required to carry workers compensation insurance then a Certificate of Exception must be obtained from the State. See


31

http://www.in.gov/dor/4473.htm. Form WCE-1 can be obtained at https://forms.in.gov/download.aspx?id=7134. Worker’s Statutory Statutory Employer’s Liability: $ 1,000,000 each accident or disease $ 1,000,000 policy limit $ 1,000,000 each employee University as Additional “The Trustees of Indiana University, Trustees of Indiana

University, it’s officers, agents and employees” shall be added as an additional

insured under the commercial general and automobile liability policies only.

INSURANCE CARRIERS All insurance carriers selected by contractor must be rated “A-” or above in the most recent edition of the “A.M. Best’s Key Rating Guide.” Hold Harmless Agreement: Contractor shall indemnify and save harmless the Owner from any and all losses, costs, damages, liability and expenses, including reasonable attorney fees, arising out of or in conjunction with claims or suits for damage to property and/or injury to persons, including contractor’s employees and all sub-contractor’s employees at any tier, including death, alleged or claimed to have been caused by or through the performance of the work or operations incidental to the work by the Contractor, its agents or employees, or by its subcontractors of any tier, their agents or employees, whether through negligence or willful act; and Contractor shall, at the request of Owner, undertake to investigate and defend any and all such claims or suits against Owner. Anything herein contained to the contrary notwithstanding, the Owner and Contractor waive all rights, each against the other, for damages caused by perils covered by any insurance purchased in accordance with the provisions of the Fire and Extended Coverage section of the Contractor’s insurance policy, except such rights as they may have to the proceeds of such insurance. This provision shall not release the Contractor from its obligation to complete,

http://www.in.gov/dor/4473.htm

https://forms.in.gov/download.aspx?id=7134


32

according to plans and specifications, the project covered by the Contract and the Contractor and its Surety shall be obligated to the full performance of the Contractor’s undertaking. Revision Date 8/2007


33

Appendix D: Federal Debarment Certification

_____________________ (date)

Purchasing Department

Indiana University 400 E. 7th Street Bloomington, IN 47405

In accordance with the Federal Acquisition Regulation, 52.209-5:

(a) (1) The Company certifies, to the best of its knowledge and belief, that—

(i) The Company and/or any of its Principals—

(A) (check one) Are ( ) or are not ( ) presently debarred, suspended, proposed for debarment, or declared ineligible for the award of contracts by any Federal agency; (The debarred list (List of Parties Excluded from Federal Procurement and Nonprocurement Programs) is at http://epls.arnet.gov on the Web.)

(B) (check one) Have ( ) or have not ( ), within a three-year period preceding this offer, been convicted of or had a civil judgment rendered against them for: commission of fraud or a criminal offense in connection with obtaining, attempting to obtain, or performing a public (Federal, state, or local) contract or subcontract; violation of Federal or state antitrust statutes relating to the submission of offers; or commission of embezzlement, theft, forgery, bribery, falsification or destruction of records, making false statements, tax evasion, or receiving stolen property; and (C) (check one) Are ( ) or are not ( ) presently indicted for, or otherwise criminally or civilly charged by a governmental entity with, commission of any of the offenses enumerated in paragraph (a)(1)(i)(B) of this provision.

(ii) The Company (check one) has ( ) or has not ( ), within a three-year period preceding this offer, had one or more contracts terminated for default by any Federal agency.

(2) “Principals,” for the purposes of this certification, means officers; directors; owners; partners; and, persons having primary management or supervisory responsibilities within a business entity (e.g., general manager; plant manager; head of a subsidiary, division, or business segment, and similar positions).

http://epls.arnet.gov/


34

This Certification Concerns a Matter Within the Jurisdiction of an Agency of the United States and the Making of a False, Fictitious, or Fraudulent Certification May Render the Maker Subject to Prosecution Under Section 1001, Title 18, United States Code.

(b) The Company shall provide immediate written notice to the Contracting Officer if, at any time prior to contract award, the Company learns that its certification was erroneous when submitted or has become erroneous by reason of changed circumstances. (c) A certification that any of the items in paragraph (a) of this provision exists will not necessarily result in withholding of an award under this solicitation. However, the certification will be considered in connection with a determination of the Company’s responsibility. Failure of the Company to furnish a certification or provide such additional information as requested by the Contracting Officer may render the Company non-responsible. (d) Nothing contained in the foregoing shall be construed to require establishment of a system of records in order to render, in good faith, the certification required by paragraph (a) of this provision. The knowledge and information of a Company is not required to exceed that which is normally possessed by a prudent person in the ordinary course of business dealings. (e) The certification in paragraph (a) of this provision is a material representation of fact upon which reliance was placed when making award. If it is later determined that the Company knowingly rendered an erroneous certification, in addition to other remedies available to the Government, the Contracting Officer may terminate any contract with the Company for default.

________________________________ (firm) ________________________________ (address) ________________________________ ________________________________ (signature required) (Phone) ________________________________ ________________________________ (print name) (fax) ________________________________ ________________________________ (print title) (Federal Taxpayer ID Number)

request for proposal ddi (dns-dhcp-ipam) solution · quality computing, voice and data...

Documents